Prevent generated executables from overwriting project files

[thiremani]

Problem

The compiler derives a script executable destination from the script filename and passes that path directly to the linker. Some valid script filenames therefore target existing project files:

• pt.mod.spt targets pt.mod
• lib.pt.spt targets lib.pt

The linker can replace those files, causing source or module-definition data loss. This behavior predates PR #78; script-name validation should not be used as the primary output-collision policy.

Expected behavior

The compiler must never overwrite pt.mod, .pt, .spt, or another project input. Rebuilding an executable previously produced by Pluto should continue to work.

Design notes

A blanket destination-already-exists rejection would break normal rebuilds. The implementation needs to distinguish compiler-owned outputs from project inputs, validate the final destination before linking, and preferably link to a temporary file before atomically replacing a validated compiler-owned output.

Regression coverage

• Refuse a pt.mod.spt collision and preserve the original pt.mod contents.
• Refuse a collision with a .pt or .spt input and preserve its contents.
• Permit rebuilding an executable previously generated by Pluto.
• Verify a failed link cannot leave a partial destination file.